HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPHIPIIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Anesthesia Services of San Joaquin PC

bd_cfbf7b9635ada953 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 25, 2022

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

72%

Full breach record for Anesthesia Services of San Joaquin PC →

Anesthesia Services of San Joaquin PC reported a breach originating at its third-party management company, which identified suspicious activity on July 11, 2022. The management company stores protected health information for the anesthesia practice. Potentially compromised data includes names, SSNs, dates of birth, driver's license numbers, financial account information, health insurance policy numbers, Medical Record Numbers, Medicaid/Medicare IDs, and health treatment/diagnosis information. Notification letters were sent October 24, 2022.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 9, 2022

Begins

Oct 25, 2022

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_9f1dc0acaf4a8ae32022-10-25Verified
Montana State AGbd_435772c570670bff2022-10-24 · +1dCandidate
HHS OCRbd_38da7a9eacda20ff2022-09-23 · +32dCandidate

Name: Anesthesia Services of San Joaquin PC
norm: anesthesia services of san joaquin

Name: Anesthesia Services of San Joaquin PC
norm: anesthesia services of san joaquin
Industry: Healthcarellm

Discovered: —
Breach occurred: Jul 9, 2022 – Jul 11, 2022
Materiality determined: —
Notification sent: Oct 24, 2022
Affected individuals: Not disclosed
Data types: PHIPIIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External

During the incident: Management company implemented its incident response protocols
Disconnected all systems
Engaged external cybersecurity experts to conduct a forensic investigation
Reviewed potentially impacted information to identify any protected health information that may have been affected
Offering identity theft protection services through IDX, the data breach and recovery services expert
Changes made: Conducting a global password reset
Tightening firewall restrictions
Implementing endpoint threat detection and response monitoring software on workstations and servers
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRSep 23 · first

Montana State AG+31d

Maine State AG+32d

California State AG+32d · this page

Pattern: first filing Sep 23 (NY), last Oct 25 (CA) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558563
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 25, 2022
Raw hash: 636b005d4e89bd8436f488ae725b546e8760e6a8d5cf24facddd295b482c70e8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAnesthesia Services of San Joaquin PC

Victim entityAnesthesia Services of San Joaquin PC

IncidentUnauthorized Access

Stated responseManagement company implemented its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov